SAA-C03 Practice Exam 2 — 20 Questions

Question 1

Refer to the exhibit. A company is using this S3 bucket policy to secure high-performance data accessed by an analytics fleet on EC2. Users report that despite having the correct IAM permissions, they are receiving 403 Forbidden errors when trying to download data. What is the most likely cause of this performance and access issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The EC2 instances are not using the specified VPC Endpoint to access S3.. The bucket policy shown in the exhibit restricts access to requests originating from a specific VPC Endpoint (aws:sourceVpce condition). If the EC2 instances are not routing S3 traffic through that endpoint — for example, they are using the public S3 endpoint or a different endpoint — the policy denies the request and S3 returns 403 Forbidden even though the IAM role has s3:GetObject. The fix is to ensure the instances use the specified VPC Endpoint (via route table entries or endpoint policies).

Answer

The S3 bucket is in a different region than the EC2 instances.

Answer

The IAM role assigned to the EC2 instances lacks S3:GetObject permissions.

Answer

The S3 bucket has Object Lock enabled, preventing data retrieval.

Question 2

An architect is designing a secure VPC architecture. Which TWO actions should be taken to ensure the infrastructure is compliant with security best practices regarding network isolation?

Accepted Answer

Use Network ACLs as a stateless firewall for subnet-level traffic control.. Option B is correct because Network ACLs are stateless, subnet-level firewalls that evaluate inbound and outbound rules independently, providing an additional layer of traffic control for network isolation in a VPC. Option D is correct because Security Groups are stateful, instance-level firewalls that automatically allow return traffic for permitted connections, which is a fundamental AWS best practice for controlling access to EC2 instances. Option A is incorrect because placing all EC2 instances in a public subnet exposes them directly to the internet and violates network isolation best practices; instances that don't need public access should reside in private subnets. Option C is incorrect because allowing all traffic from 0.0.0.0/0 on all ports effectively disables firewall protection and is a severe security misconfiguration. Option E is incorrect because disabling VPC Flow Logs removes valuable network traffic visibility needed for monitoring, auditing, and incident response, and cost reduction should not come at the expense of security observability.

Answer

Place all EC2 instances in the public subnet to maximize accessibility.

Answer

Configure Security Groups to allow all traffic (0.0.0.0/0) on all ports.

Answer

Disable VPC Flow Logs to reduce the storage costs in S3.

Question 3

A data analytics company stores massive amounts of data in Amazon S3. They need a way to automatically identify and flag sensitive data, such as Personally Identifiable Information (PII) or financial records, to ensure it is not being mishandled. Which AWS service is designed for this task?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service. It uses machine learning and pattern matching to automatically discover and protect sensitive data in Amazon S3. Macie provides a dashboard and findings that alert the security team to PII, helping them maintain data privacy compliance.

Answer

Amazon GuardDuty

Answer

AWS Glue

Answer

Amazon Inspector

Question 4

A startup is launching a new application with a microservices architecture. One specific service is an API that is only called a few dozen times per day. The execution time is always under 10 seconds. Which compute service would be the most cost-effective for this microservice?

Accepted Answer

AWS Lambda.. AWS Lambda is the most cost-effective choice because it charges only for the compute time consumed per invocation, with no charge when the function is idle. An API called a few dozen times per day with sub-10-second execution fits well within Lambda's 15-minute limit and free tier. There is no need to pay for a continuously running instance or container, making Lambda far cheaper than EC2, Fargate, or Lightsail for this sporadic workload.

Answer

Amazon EC2 T3-micro instances.

Answer

Amazon ECS on AWS Fargate.

Answer

Amazon Lightsail.

Question 5

A global gaming company needs to provide low-latency access to user profile data for players in North America, Europe, and Asia. The data is stored in an Amazon Aurora MySQL database. The application requires that reads be as local as possible, while writes are infrequent and can tolerate some propagation delay. Which solution offers the best performance?

Accepted Answer

Set up Aurora Global Database with secondary clusters in each required region.. Aurora Global Database is purpose-built for this exact scenario: it replicates data from a primary Aurora cluster to secondary clusters in other regions with typical latency under one second, and the secondary clusters serve low-latency local reads. Because writes are infrequent and can tolerate propagation delay, the asynchronous replication model is acceptable, and each region's application can read from its local secondary cluster endpoint. This delivers the lowest read latency across North America, Europe, and Asia while keeping the source of truth in a single primary region.

Answer

Deploy a single Aurora cluster and use CloudFront to cache database queries.

Answer

Use Cross-Region Read Replicas for standard RDS MySQL instances.

Answer

Implement a DynamoDB Global Table with DAX in every region.

Question 6

A company needs a Disaster Recovery (DR) strategy with an RTO of 30 minutes and an RPO of 15 minutes. They want to minimize costs while having a scaled-down version of their core environment always running in a second region. Which DR strategy should they use?

Accepted Answer

Warm Standby.. A Warm Standby DR strategy involves running a functional but scaled-down version of the application in a separate region. This allows for a very low Recovery Time Objective (RTO) because the core infrastructure is already live. Data is replicated frequently to meet the Recovery Point Objective (RPO) of 15 minutes, providing a balance between cost and speed.

Answer

Backup and Restore.

Answer

Pilot Light.

Answer

Multi-site Active-Active.

Question 7

A developer is using an EC2 instance to process images. The images are stored in an S3 bucket. The developer notices that the network transfer between S3 and the EC2 instance is the bottleneck. How can the developer resolve this?

Accepted Answer

Use an Amazon S3 Gateway Endpoint.. An Amazon S3 Gateway Endpoint allows EC2 instances in a VPC to access S3 without traversing the public internet or a NAT gateway. Traffic stays within the AWS network, which can reduce latency and improve throughput, resolving the network bottleneck. It also eliminates data transfer costs associated with NAT gateways.

Answer

Increase the EC2 instance size.

Answer

Enable S3 Transfer Acceleration.

Answer

Use CloudFront to cache the images.

Question 8

Refer to the exhibit. The web application is showing high latency and 503 errors. The database CPU usage is low. What is the most likely cause and solution?

Accepted Answer

Implement Amazon RDS Proxy for connection pooling.. The symptoms — high latency, 503 errors, low database CPU — point to connection exhaustion rather than compute saturation. Each application instance opening its own database connections can exhaust the RDS max_connections limit, causing new connections to be refused and 503s to surface at the web tier. Amazon RDS Proxy pools and multiplexes connections, allowing many application connections to share a smaller set of database connections, which resolves the bottleneck without scaling the database.

Answer

Increase the RDS instance size to handle more connections.

Answer

Enable Multi-AZ failover to distribute the load.

Answer

Add more read replicas to the RDS cluster.

Question 9

A company wants to ensure that no developer can create an Amazon S3 bucket in any AWS region except for us-east-1 and us-west-2 across their entire AWS Organization. Which solution provides the most efficient and centralized way to enforce this across all member accounts?

Accepted Answer

Attach a Service Control Policy (SCP) to the organization root that denies s3:CreateBucket if the region is not us-east-1 or us-west-2.. A Service Control Policy (SCP) attached to the organization root applies to all member accounts and can deny s3:CreateBucket when the requested region is not us-east-1 or us-west-2. SCPs are the centralized, efficient way to enforce guardrails across an AWS Organization, affecting all principals without per-account changes.

Answer

Apply an IAM policy to every developer user in each account that denies s3:CreateBucket in restricted regions.

Answer

Configure an S3 bucket policy on all existing buckets to prevent the creation of new buckets in other regions.

Answer

Enable AWS Config in all accounts and create a custom rule to delete any bucket created in a restricted region.

Question 10

An application has been migrated to AWS, but the performance is inconsistent. The architect finds that the application uses a legacy database driver that requires persistent connections, which is exhausting database connections. What is the best way to handle this?

Accepted Answer

Use Amazon RDS Proxy.. Amazon RDS Proxy sits between the application and the database, pooling and reusing persistent connections so that many application connections map to a small number of database connections. This directly addresses the legacy driver's persistent-connection behavior that is exhausting the database's connection limit, without requiring application changes.

Answer

Increase the max_connections parameter.

Answer

Implement a local database connection pooler.

Answer

Migrate to Amazon Aurora Serverless.

Question 11

A company hosts a web application on EC2 instances behind an Application Load Balancer (ALB). The application has spikes in traffic. What should be configured to ensure performance and cost efficiency?

Accepted Answer

Implement Auto Scaling with target tracking policies.. Target tracking scaling policies automatically adjust the number of EC2 instances based on a specified metric (e.g., average CPU utilization or request count per target), maintaining performance during spikes while scaling in during low demand to optimize cost. This is the most efficient and responsive approach for variable workloads behind an ALB.

Answer

Use a fixed size Auto Scaling group at maximum capacity.

Answer

Configure the ALB to handle all scaling automatically.

Answer

Use reserved instances to handle all peak traffic.

Question 12

Refer to the exhibit. A solutions architect reviewed an AWS CloudFormation template used to deploy an Auto Scaling group for a production web application. During an AWS Availability Zone outage in us-east-1, users experienced partial application downtime even though the Auto Scaling group reported instances running. Why is this architecture failing resiliency best practices?

Accepted Answer

The Auto Scaling group defines Availability Zones directly instead of referencing subnets across multiple zones.. For an Auto Scaling group to survive an Availability Zone outage, it must launch instances across multiple subnets in different AZs. When the ASG specifies Availability Zones directly (or uses a single subnet), all instances land in one AZ, so an AZ failure takes down the entire fleet even though the ASG still reports 'running' instances in the failed zone. Referencing subnets across multiple AZs lets the ASG rebalance and launch replacements in healthy zones.

Answer

The Launch Template version is hardcoded to version 1 instead of using $Latest or $Default.

Answer

The MinSize and DesiredCapacity are set too low to handle sudden spikes in traffic during an outage.

Answer

The Auto Scaling group is missing a health check type configuration set to ELB instead of EC2.

Question 13

A company wants to improve the security of its Amazon RDS for PostgreSQL database. They want to eliminate the need for storing database passwords in application code and simplify the management of database access for their EC2-based applications. Which solution should they implement?

Accepted Answer

Configure the RDS instance to use IAM Database Authentication and assign a role to the EC2 instances.. IAM Database Authentication for RDS for PostgreSQL lets EC2 instances (or other AWS principals) authenticate to the database using short-lived authentication tokens generated from their IAM role credentials, so no static database password is ever stored in application code. The EC2 instance assumes an IAM role, and the RDS instance is configured to allow IAM authentication; the application then calls generate-db-auth-token (or the SDK equivalent) to obtain a 15-minute token used as the password. This eliminates password storage and centralizes access management through IAM policies, satisfying both the security and simplification goals.

Answer

Use AWS Secrets Manager to store the RDS credentials and retrieve them at runtime.

Answer

Enable SSL/TLS encryption for all database connections to protect the password in transit.

Answer

Store the database password in a private S3 bucket and allow the EC2 instances to read the file.

Question 14

A company has a multi-region application and wants to provide users with a single entry point that automatically routes traffic to the closest healthy endpoint. The solution must support non-HTTP protocols and provide static IP addresses. Which service should be used?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network to improve the availability and performance of applications. It provides static IP addresses that act as a fixed entry point and can route traffic to endpoints in multiple regions using any TCP or UDP protocol, ensuring optimal performance.

Answer

Amazon CloudFront

Answer

Application Load Balancer (ALB)

Answer

Amazon Route 53 with Multivalue Answer routing.

Question 15

A media streaming company stores high-value video assets in an Amazon S3 bucket. The company requires a resilient storage architecture that protects against accidental deletion, malicious overwrites, and zonal or regional outages. Which combinations of features should a Solutions Architect implement to achieve these requirements? (Choose TWO.)

Accepted Answer

Enable S3 Versioning on the bucket and configure MFA Delete to prevent accidental or malicious deletion of object versions.. Enabling S3 Versioning ensures that previous versions are retained when objects are deleted or overwritten, protecting against accidental data loss. Furthermore, replicating objects to another AWS Region using S3 Cross-Region Replication guarantees durability and availability against catastrophic regional disruptions, satisfying robust disaster recovery best practices for critical media assets.

Answer

Configure Amazon S3 Intelligent-Tiering to automatically move infrequently accessed video assets to lower-cost storage tiers.

Answer

Attach a resource-based bucket policy that explicitly denies all delete object requests from any IAM user except the root account.

Answer

Enable S3 Object Lock in governance mode with a fixed retention period of 30 days for all uploaded video files.

Question 16

A financial services company is hosting a critical web application on Amazon EC2 instances behind an Application Load Balancer. The application must remain available even if an entire AWS Region experiences a major outage. The database tier uses Amazon Aurora Global Databases. Which solution provides the most resilient multi-Region architecture with automated failover?

Accepted Answer

Deploy the application stack across two AWS Regions, use Amazon Route 53 with active-passive failover and automated health checks, and configure Amazon Aurora Global Databases with cross-region replication.. Deploying Route 53 with active-passive failover and automated health checks combined with a secondary Region ensures automatic traffic rerouting during a regional disaster. Aurora Global Databases minimize replication lag and permit fast promotion of the secondary region database, maintaining data consistency and business continuity for critical financial applications requiring minimal recovery time objectives.

Answer

Configure an Application Load Balancer in a single Region with EC2 instances distributed across multiple Availability Zones, and back the application with a standard Aurora MySQL database instance.

Answer

Use Amazon Route 53 with weighted routing policies to distribute traffic between two AWS Regions, and configure standard cross-region database replication using Amazon RDS snapshots taken every hour.

Answer

Set up an AWS Global Accelerator standard accelerator with endpoint groups in two AWS Regions, and use Amazon DynamoDB global tables with local secondary indexes for data storage.

Question 17

An organization needs to issue and manage SSL/TLS certificates for its internal microservices, which are not accessible from the public internet. They want to avoid the overhead of managing their own PKI infrastructure. Which service should they use?

Accepted Answer

AWS Certificate Manager (ACM) Private Certificate Authority (PCA).. AWS Certificate Manager (ACM) Private Certificate Authority (PCA) is a managed private CA service that helps you easily and securely manage the lifecycle of your private certificates. It eliminates the need for organizations to maintain their own complex and costly internal PKI while still providing the security of private certificates.

Answer

AWS Certificate Manager (ACM) to request public certificates for the services.

Answer

AWS CloudHSM to store and manage the private keys for the certificates.

Answer

Amazon Inspector to audit the certificates used by the microservices.

Question 18

A company is launching a high-profile marketing campaign and expects a significant increase in traffic. They are concerned about potential Distributed Denial of Service (DDoS) attacks targeting their Application Load Balancer. Which AWS service provides advanced protection and includes 24/7 access to the AWS Shield Response Team (SRT)?

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced provides expanded DDoS protection for web applications. Unlike the free Standard tier, it includes additional mitigation capabilities, 24/7 access to the Shield Response Team, and financial protection against bill spikes caused by DDoS attacks, making it ideal for high-profile applications.

Answer

AWS Shield Standard

Answer

AWS WAF

Answer

AWS Global Accelerator

Question 19

A healthcare company must store patient records in Amazon S3 for a minimum of 7 years to meet regulatory requirements. During this period, the records must not be deleted or modified by any user, including the root user. Which S3 feature should be used to enforce this?

Accepted Answer

S3 Object Lock in Compliance mode. S3 Object Lock provides Write-Once-Read-Many (WORM) protection. When configured in Compliance mode, an object version cannot be deleted or overwritten by any user, including the root user, for the duration of the retention period. This is the only way to satisfy strict regulatory requirements for data immutability.

Answer

S3 Versioning with MFA Delete

Answer

S3 Object Lock in Governance mode

Answer

S3 Lifecycle policy with an expiration of 7 years

Question 20

Refer to the exhibit. An IAM policy is applied to an IAM user to grant access to an S3 bucket. However, the user is still receiving an 'Access Denied' error when attempting to list the objects in the bucket. What is the cause of this error?

Accepted Answer

The policy is missing the s3:ListBucket permission.. The provided policy grants the 's3:GetObject' permission, which allows the user to read specific objects within the bucket, but it does not grant 's3:ListBucket'. The ListBucket permission is required to view the contents of the bucket. Since the user lacks this permission, the operation fails with an Access Denied error despite having access to individual objects. This is a common permissions oversight in IAM policy management.

Answer

The user does not have an IAM role attached.

Answer

The bucket policy is explicitly denying access.

Answer

The S3 bucket is encrypted with a KMS key.